Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-87981 | medium | 4.7 | No | The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its... | 2026-09-23 |
| CVE-2026-87979 | medium | 5.3 | No | The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webh... | 2026-09-23 |
| CVE-2026-86785 | medium | 5.3 | No | The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, all... | 2026-09-23 |
| CVE-2026-88974 | medium | 5.4 | No | WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks o... | 2026-09-23 |
| CVE-2026-73858 | medium | 5.3 | No | Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public... | 2026-09-23 |
| CVE-2026-61685 | high | 7.5 | No | ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` c... | 2026-09-23 |
| CVE-2026-77426 | not reported | — | No | Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. PO... | 2026-09-23 |
| CVE-2026-77425 | medium | 4.3 | No | Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environment... | 2026-09-23 |
| CVE-2026-76909 | not reported | — | No | Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/reque... | 2026-09-23 |
| CVE-2026-83801 | medium | 5.4 | No | Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.add_relationship or ext... | 2026-09-23 |
| CVE-2026-79767 | medium | 5.5 | No | Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.14... | 2026-09-23 |
| CVE-2026-77322 | high | 7.5 | No | SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.3, WSConnection.Read in sip/transport_ws.go creates a wsutil.Re... | 2026-09-23 |
| CVE-2026-65829 | medium | 5.3 | No | MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, readin... | 2026-09-23 |
| CVE-2026-63627 | not reported | — | No | mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeF... | 2026-09-23 |
| CVE-2026-59991 | high | 7.5 | No | psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDImage.numpy() allocat... | 2026-09-23 |
| CVE-2026-58268 | high | 7.5 | No | SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parser_stream.go allocates a... | 2026-09-23 |
| CVE-2026-94462 | high | 7.1 | No | Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associ... | 2026-09-23 |
| CVE-2026-91130 | not reported | — | No | Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in... | 2026-09-23 |
| CVE-2026-77399 | medium | 6.5 | No | icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 6.1.0 until 7.2.2, vInt.from_ical accepts an at... | 2026-09-23 |
| CVE-2026-57149 | critical | 9.9 | No | plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of portlets that ship wit... | 2026-09-23 |